---
id: "CVE-2026-115570"
kind: "vulnerability"
aliases: ["CVE-2026-115570", "GHSA-jr5w-w6x2-84p9"]
title: "Electron: Mitigation for compromised eMudhra intermediate certificates"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "electron", "fixed": ["45.0.0-beta.6"], "affected": ">= 45.0.0-alpha.1, < 45.0.0-beta.6", "ecosystem": "npm"}, {"name": "electron", "fixed": ["44.9.1"], "affected": ">= 44.0.0-alpha.1, < 44.9.1", "ecosystem": "npm"}, {"name": "electron", "fixed": ["43.8.1"], "affected": ">= 43.0.0-alpha.1, < 43.8.1", "ecosystem": "npm"}, {"name": "electron", "fixed": ["42.11.16"], "affected": "< 42.11.16", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-299", "desktop-apps", "electron", "node", "runtime"]
not_affected_if: ["already-patched-version", "no-network-connections"]
published_at: "2026-10-23T19:17:44+00:00"
first_seen_at: "2026-10-23T20:59:05+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-jr5w-w6x2-84p9", "first_seen_at": "2026-10-23T20:59:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115570", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Electron: Mitigation for compromised eMudhra intermediate certificates

Electron shipped a blocklist for eMudhra intermediate certificates that were compromised, so Chromium networking and Node.js tls, https and fetch now reject them. Before the fix, an attacker holding a certificate issued through those intermediates and able to intercept traffic could impersonate a TLS server to an app.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:electron affected >= 45.0.0-alpha.1, < 45.0.0-beta.6 fixed 45.0.0-beta.6
- npm:electron affected >= 44.0.0-alpha.1, < 44.9.1 fixed 44.9.1
- npm:electron affected >= 43.0.0-alpha.1, < 43.8.1 fixed 43.8.1
- npm:electron affected < 42.11.16 fixed 42.11.16

## How to check

Check the Electron version in the app's package.json or installed node_modules/electron/package.json.
An app is in range if its version is below 45.0.0-beta.6 on the 45 line, below 44.9.1 on 44, below 43.8.1 on 43, or below 42.11.16 on 42.
Apps that make no network connections are not affected.

## Fix

Upgrade electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16, matching your release line.
There are no app-side workarounds.

## Timeline

- 2026-10-23T20:59:05+00:00 ghsa https://github.com/advisories/GHSA-jr5w-w6x2-84p9
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115570

## From the sources

### Impact

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.

Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.

Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).

### Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions

* `45.0.0-beta.6`
* `44.9.1`
* `43.8.1`
* `42.11.16`

### For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_